FY Force trust center
How we protect your organization's records, who handles them, and where to ask for more.
Security overview
Hosting
All customer data is hosted on Amazon Web Services in the us-east-2 (Ohio) region. The AWS account is dedicated to FY Network products.
Encryption at rest
The database, evidence files, backups, and logs are encrypted with a dedicated AWS KMS key.
Encryption in transit
The service is served over HTTPS only, with TLS 1.2 and 1.3. Plain HTTP only redirects. Database connections require TLS.
Evidence files
Uploaded evidence is versioned, is never publicly accessible, and access to evidence files is logged.
Backups
Backups are kept for 35 days. Restore drill completed October 2026: database restored in under 9 minutes.
Tenant isolation
Each customer organization's records are separated in the database by row-level security that is enforced even for the database owner role.
Business Associate Agreement
FY Network has accepted the AWS Business Associate Addendum for the AWS account that hosts FY Force. Customers who need to store protected health information must first sign a BAA with FY Network.
Monitoring
Uptime, the background worker, and the database are monitored with alarms, and live service status is public.
Subprocessors
These companies process customer data on our behalf. The same list is in our privacy notice.
| Company | What they do | Location |
|---|---|---|
| Amazon Web Services, Inc. | Hosting, storage, backups, and email delivery through Amazon Simple Email Service | United States (us-east-2, Ohio) |
| Stripe, Inc. | Payment processing | United States |
Request a BAA or security questionnaire
Tell us what you need and we will reply by email.